EP2013733B1 - Fehlerfilterung in fehlertoleranten datenverarbeitungssystemen - Google Patents
Fehlerfilterung in fehlertoleranten datenverarbeitungssystemen Download PDFInfo
- Publication number
- EP2013733B1 EP2013733B1 EP07716774A EP07716774A EP2013733B1 EP 2013733 B1 EP2013733 B1 EP 2013733B1 EP 07716774 A EP07716774 A EP 07716774A EP 07716774 A EP07716774 A EP 07716774A EP 2013733 B1 EP2013733 B1 EP 2013733B1
- Authority
- EP
- European Patent Office
- Prior art keywords
- programmable
- logic devices
- logic
- field
- error
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
- G06F11/183—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits by voting, the voting not being performed by the redundant components
- G06F11/184—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits by voting, the voting not being performed by the redundant components where the redundant components implement processing functionality
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0736—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function
- G06F11/0739—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function in a data processing system embedded in automotive or aircraft systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0793—Remedial or corrective actions
Definitions
- FPGA field-programmable gate array
- a single event transient (SET) error is an SEU event that does not get latched, causing a transient effect.
- SET single event transient
- a single transient effect will only impede normal operation of the FPGA for a short duration, and an automatic reconfiguration of the FPGA is often unnecessary. Any unnecessary reconfigurations will lead to increased signal processing delays.
- US Patent Specification No 6104211 discloses a system for radiation-tolerating a single event fault in an electronic circuit, but a reconfiguration from configuration memory may result in a loss of user data.
- US Patent Specification 5655069 is a fault-tolerant information processing system has a main processor for managing the overall system.
- US Patent Specification 6178522 describes a system for managing redundant computers with fault tolerance by masking erroneous data and excluding faulty nodes.
- US Patent Specification 2004/0078653 discloses a voting system having error counters implementing an error filter.
- the present invention provides a system as defined in Claim 1.
- the system may provide the features of any one or more of dependent claims 2 to 5.
- Embodiments of the present invention address problems with monitoring single event fault tolerance in an electronic circuit and will be understood by reading and studying the following specification.
- a system for tolerating a single event fault in an electronic circuit includes a main processor, a fault detection processor responsive to the main processor, the fault detection processor further comprising a voter logic circuit, three or more logic devices responsive to the fault detection processor, each output of the three or more logic devices passing through the voter logic circuit, and a programmable error filter. An output of the voter logic circuit is coupled to the programmable error filter.
- Embodiments of the present invention address problems with monitoring single event fault tolerance in an electronic circuit and will be understood by reading and studying the following specification.
- a system for tolerating a single event fault in an electronic circuit includes a main processor, a fault detection processor responsive to the main processor, the fault detection processor further comprising a voter logic circuit, three or more logic devices responsive to the fault detection processor, each output of the three or more logic devices passing through the voter logic circuit, and a programmable error filter. An output of the voter logic circuit is coupled to the programmable error filter.
- embodiments of the present invention are not limited to determining single event fault tolerance for high-reliability applications. Embodiments of the present invention are applicable to any fault tolerance determination activity in electronic circuits that requires a high level of reliability. Alternate embodiments of the present invention utilize external triple modular component redundancy (TMR) with three or more logic devices operated synchronously with one another. The output of a TMR voter circuit is applied to a programmable error filter. The programmable error filter flags an error only if an error count has exceeded a programmable error threshold, allowing periodic single event transient (SET) errors to pass through.
- TMR triple modular component redundancy
- FIG. 1 is a block diagram of an embodiment of a fault tolerant computing system, indicated generally at 100, according to the teachings of the present invention.
- System 100 includes fault detection processor assembly 102 and system controller 110.
- System controller 110 is a microcontroller, a programmable logic device, or the like.
- Fault detection processor assembly 102 also includes logic devices 104 A to 104 C , fault detection processor 106, and logic device configuration memory 108, each of which are discussed below. It is noted that for simplicity in description, a total of three logic devices 104 A to 104 C are shown in Figure 1 . However, it is understood that fault detection processor assembly 102 supports any appropriate number of logic devices 104 (e.g., three or more logic devices) in a single fault detection processor assembly 102.
- Fault detection processor 106 is any logic device (e.g., an ASIC), with a configuration manager, the ability to host TMR voter logic with a programmable error filter, and an interface to provide at least one output to a distributed processing application system controller, similar to system controller 110.
- TMR requires each of logic devices 104 A to 104 C to operate synchronously with respect to one another. Control and data signals from each of logic devices 104 A to 104 C are voted against each other in fault detection processor 106 to determine the legitimacy of the control and data signals.
- Each of logic devices 104 A to 104 C are programmable logic devices such as a field-programmable gate array (FPGA), a complex programmable logic device (CPLD), a field-programmable object array (FPOA), or the like.
- FPGA field-programmable gate array
- CPLD complex programmable logic device
- FPOA field-programmable object array
- System 100 forms part of a larger distributed processing application (not shown) using multiple processor assemblies similar to fault detection processor assembly 102.
- Fault detection processor assembly 102 and system controller 110 are coupled for data communications via distributed processing application interface 112.
- Distributed processing application interface 112 is a high speed, low power data transmission interface such as Low Voltage Differential Signaling (LVDS), a high-speed serial interface, or the like.
- distributed processing application interface 112 transfers at least one set of default configuration software machine-coded instructions for each of logic devices 104 A to 104 C from system controller 110 to fault detection processor 106 for storage in logic device configuration memory 108.
- Logic device configuration memory 108 is a double-data rate synchronous dynamic read-only memory (DDR SDRAM) or the like.
- logic device configuration memory 108 is loaded during initialization with the at least one set of default configuration software machine-coded instructions.
- Fault detection processor 106 continuously monitors each of logic devices 104 A to 104 C for one or more single event fault conditions. The monitoring of one or more single event fault conditions is accomplished by TMR voter logic 202.
- TMR voter logic 202 filters each single event fault condition. When one or more filtered single event fault conditions exceeds a programmable SET error threshold, system controller 110 automatically coordinates a backup of state information currently residing in the faulted logic device and begins a reconfiguration sequence. The reconfiguration sequence is described in further detail below with respect to Figures 2 and 3 .
- system controller 110 interrupts the operation of all three logic devices 104 A to 104 C to bring each of logic devices 104 1 to 104 3 back into synchronous operation.
- FIG. 2 is a block diagram of an embodiment of a circuit, indicated generally at 200, for detecting single event fault conditions according to the teachings of the present invention.
- An exemplary embodiment of circuit 200 is described in the '290 Application.
- Circuit 200 includes fault detection processor 106 of Figure 1 (e.g., a radiation-hardened ASIC).
- Fault detection processor 106 includes TMR voter logic 202, configuration manager 204, memory controller 206, system-on-chip (SOC) bus arbiter 208, register bus control logic 210, and inter-processor network interface 212, each of which are discussed below.
- Circuit 200 also includes logic devices 104 A to 104 C , each of which is coupled for data communications to fault detection processor 106 by device interface paths 230 A to 230 C , respectively.
- Each of device interface paths 230 A to 230 C are composed of a high-speed, full duplex communication interface for linking each of logic devices 104 A to 104 C with TMR voter logic 202.
- Each of logic devices 104 A to 104 C is further coupled to fault detection processor 106 by configuration interface paths 232 A to 232 C , respectively.
- Each of configuration interface paths 232 A to 232 C is composed of a full duplex communication interface used for configuring each of logic devices 104 A to 104 C by configuration manager 204. It is noted that for simplicity in description, a total of three logic devices 104 A to 104 C , three device interface paths 230 A to 230 C , and three configuration interface paths 232 A to 232 C are shown in Figure 2 .
- circuit 200 supports any appropriate number of logic devices 104 (e.g., three or more logic devices), device interface paths (e.g., three or more device interface paths), and configuration interface paths (e.g., three or more configuration interface paths) in a single circuit 200.
- logic devices 104 e.g., three or more logic devices
- device interface paths e.g., three or more device interface paths
- configuration interface paths e.g., three or more configuration interface paths
- TMR voter logic 202 and configuration manager 204 are coupled for data communications to register bus control logic 210 by voter logic interface 220 and configuration manager interface 224.
- Voter logic interface 220 and configuration manager interface 224 are bi-directional communication links used by fault detection processor 106 to transfer commands between control registers within TMR voter logic 202 and configuration manager 204.
- Register bus control logic 210 provides system controller 110 of Figure 1 access to one or more control and status registers inside configuration manager 204.
- Register bus 226 provides a bi-directional, inter-processor communication interface between register bus control logic 210 and inter-processor network interface 212.
- Inter-processor network interface 212 connects fault detection processor 106 to system controller 110 via distributed processing application interface 112.
- Inter-processor network interface 212 provides an error signal on distributed processing application interface 112.
- the error signal indicates to system controller 110 that one or more filtered single event faults have exceeded a programmable error threshold.
- the error signal is provided by error threshold comparator 309 as discussed in detail below with respect to Figure 3 .
- distributed processing application interface 112 transfers at least one set of default configuration software machine-coded instructions to fault detection processor 106 for storage in logic device configuration memory 108.
- Logic device configuration memory 108 is accessed by memory controller 206 via device memory interface 214.
- Device memory interface 214 provides a high-speed, bi-directional communication link between memory controller 206 and logic device configuration memory 108.
- Memory controller 206 receives the at least one set of default programmable logic for storing in logic device configuration memory 108 via bus arbiter interface 228, SOC bus arbiter 208, and memory controller interface 216.
- Bus arbiter interface 228 provides a bi-directional, inter-processor communication interface between SOC bus arbiter 208 and inter-processor network interface 212.
- SOC bus arbiter 208 transfers memory data from and to memory controller 206 via memory controller interface 216.
- Memory controller interface 216 provides a bi-directional, inter-processor communication interface between memory controller 206 and SOC bus arbiter 208.
- the set of default configuration software machine-coded instructions discussed above with respect to logic device configuration memory 108 is used to reconfigure each of logic devices 104 1 to 104 3 .
- SOC bus arbiter 208 provides access to memory controller 206 based on instructions received from TMR voter logic 202 on voter logic interface 218.
- Voter logic interface 218 provides a bi-directional, inter-processor communication interface between TMR voter logic 202 and SOC bus arbiter 208.
- SOC bus arbiter 208 is further communicatively coupled to configuration manager 204 via configuration interface 222.
- Configuration interface 222 provides a bi-directional, inter-processor communication interface between configuration manager 204 and SOC bus arbiter 208.
- the primary function of SOC bus arbiter 208 is to provide equal access to memory controller 206 and logic device configuration memory 108 between TMR voter logic 202 and configuration manager 204.
- configuration manager 204 performs several functions with minimal interaction from system controller 110 of Figure 1 after an initialization period.
- System controller 110 also programs one or more registers in configuration manager 204 with a location and size of the set of default configuration software machine-coded instructions discussed earlier.
- configuration manager 204 is commanded to either simultaneously configure all three logic devices 104 A to 104 C in parallel or to individually configure a single logic device from one of logic devices 104 Z to 104 C based on results provided by TMR voter logic 202.
- TMR voter logic 202 detects that one or more single event faults have exceeded the programmable error threshold, TMR voter logic 202 generates a TMR fault pulse.
- configuration manager 204 When the TMR fault pulse is detected by configuration manager 204, configuration manager 204 automatically initiates a sequence of commands to the one of logic devices 104 A to 104 C that has been determined to be at fault by TMR voter logic 202. For instance, if logic device 104 B is identified to be suspect, configuration manager 204 instructs logic device 104 B to abort. The abort instruction clears any errors that have been caused by one or more single event faults, such as an SEU or an SEFI. Configuration manager 204 issues a reset command to logic device 104 B , which halts operation of logic device 104 B . Next, configuration manager 204 issues an erase command to logic device 104 B , which clears all memory registers residing in logic device 104 B .
- logic device 104 B responds back to configuration manager 204.
- Configuration manager 204 transfers the set of default configuration software machine-coded instructions for logic device 104 B from a programmable start address in logic device configuration memory 108 to logic device 104 B . Once the transfer is completed, configuration manager 204 notifies system controller 110 that a synchronization cycle must be performed to bring each of logic devices 104 A to 104 C back into synchronization. Only the one of logic devices 104 A to 104 C that has been determined to be at fault requires reconfiguration, minimizing system restart time.
- FIG. 3 is a block diagram of an embodiment of a programmable logic interface, indicated generally at 300, for detecting single event fault conditions according to the teachings of the present invention.
- Logic interface 300 includes word synchronizers 304 A to 304 C , triple/dual modular redundancy (TMR/DMR) word voter 308, SOC multiplexer 312, and fault counters 314, each of which are discussed below.
- Logic interface 300 is composed of an input section of TMR voter logic 202 as described above with respect to Figure 2 . It is noted that for simplicity in description, a total of three word synchronizers 304 A to 304 C are shown in Figure 3 . However, it is understood that logic interface 300 supports any appropriate number of word synchronizers 304 (e.g., three or more word synchronizers) in a single logic interface 300.
- Each of word synchronizers 304 A to 304 C receive one or more original input signals from each of device interface paths 230 A to 230 C , respectively, as described above with respect to Figure 2 .
- Each of the one or more original inputs signals includes a clock signal in addition to input data and control signals from each of logic devices 104 A to 104 C of Figure 2 .
- Sending a clock signal relieves routing constraints and signal skew concerns typical of a high speed interface similar to that of device interface paths 230 A to 230 C .
- Each of word synchronizers 304 A to 304 C is provided the clock signal to sample the input data and control signals.
- the data and control signals are passed through a circular buffer inside a front end of each of word synchronizers 304 A to 304 C that aligns the input data and control signals on a word boundary with the frame signal.
- a word boundary is 20 bits wide (e.g., 16 bits of data plus 3 control signals and a clock signal), and 19 bits wide at each of synchronizer output lines 306 A to 306 C .
- Each of device interface paths 230 A to 230 C is routed with equal length to support voting on a clock cycle by clock cycle basis. After word alignment, aligned input data and control signals are transferred across clock boundary 302 and onto each of synchronizer output lines 306 A to 306 C .
- Each of synchronizer output lines 306 A to 306 C transfer synchronized outputs into a clock domain of fault detection processor 106 of Figure 1 .
- Each of synchronizer output lines 306 A to 306 C is coupled for data communication to TMR/DMR word voter 308. It is noted that for simplicity in description, a total of three synchronizer output lines 306 A to 306 C are shown in Figure 3 . However, it is understood that logic interface 300 supports any appropriate number of synchronizer output lines 306 (e.g., three or more synchronizer output lines) in a single logic interface 300.
- TMR/DMR word voter 308 further comprises error threshold comparator 309 and fault detection block 310.
- TMR/DMR word voter 308 incorporates combinational logic to compare each synchronized output from one of logic devices 104 A to 104 C against corresponding synchronized outputs from a remaining two of logic devices 104 A to 104 C once every clock cycle.
- Error threshold comparator 309 is programmed with a programmable error threshold value.
- Fault detection block 310 determines which of logic devices 104 A to 104 C is miscomparing (i.e., disagreeing). A logic device 104 that disagrees is considered a suspect device.
- An output pattern from fault detection block 310 contains three signals of all 1's if each of logic devices 104 A to 104 C is in agreement. If one of logic devices 104 A to 104 C miscompares, two signals within the output pattern will be logic zero. The two signals that agree (i.e., are each zero) cause a remaining signal to remain a logic one. The remaining signal indicates which one of logic devices 104 A to 104 C is the suspect device.
- fault counters 314 are updated by fault counter interface 320.
- fault counters 314 include error filter counter 316 and cumulative error counter 318.
- TMR/DMR word voter 308 increments error filter counter 316 by one for every miscompare, and decrements error filter counter 316 by one for every set of synchronized outputs from logic devices 104 A to 104 C that TMR/DMR word voter 308 determines to be in agreement.
- error filter counter 316 and error threshold comparator 309 represent a programmable error filter. Once error filter counter 316 is updated, fault counters 314 issues an updated error filter counter value to error threshold comparator 309.
- error threshold comparator 309 determines the updated error filter counter value of error filter counter 316 violates (i.e., exceeds) the programmable error threshold value, the suspect device will be automatically reconfigured.
- the two remaining logic devices of logic devices 104 A to 104 C continue to operate in a self-checking pair (SCP) or DMR mode.
- SCP self-checking pair
- any first miscompare between the two remaining logic devices of logic devices 104 A to 104 C in SCP mode signals a fatal error to system controller 110, and system controller 110 begins a complete recovery sequence on all three of logic devices 104 A to 104 C .
- TMR/DMR word voter 308 indicates to SOC multiplexer 312 via TMR/DMR voter output interface 322 which of logic devices 104 A to 104 C has been substantially modified by one or more single event faults.
- a reconfigure request is made to SOC bus arbiter 208.
- SOC multiplexer 312 selects affected logic device(s) for SOC bus arbiter 208 to access from voter logic interface 218.
- Error filter counter 316 tracks each single event fault error detected, and stops incrementing (decrementing) when a maximum (minimum) counter value is reached. Once error filter counter 316 exceeds the programmable error threshold value of error threshold comparator 309, system controller 110 is notified that a substantial number of single event fault conditions have occurred sequentially (i.e., exceeded the programmable error threshold value over a series of consecutive clock cycles). Until then, periodic SET errors that do not affect normal operation of logic devices 104 A to 104 C will pass through error threshold comparator 309. Error filter counter 316 allows error threshold comparator 309 to distinguish between SETs and a hard failure of at least one of logic devices 104 A to 104 C . Cumulative error counter 318 provides statistics on the SEU or SEFI rate of the interface (e.g., over the life of a space mission). Cumulative error counter 318 does not determine a faulty logic device 104.
- Figure 4 is a flow diagram illustrating a method 400 for tolerating a single event fault in an electronic circuit, in accordance with a preferred embodiment of the present invention.
- the method of Figure 4 starts at step 402.
- a programmable error threshold value is established (or updated) for error filter counter 316 (step 404).
- Method 400 then begins the process of monitoring one or more logic readings from logic devices 104 A to 104 C for possible corruption due to an occurrence of a single event fault.
- a primary function of method 400 is to update error filter counter 316 every clock cycle based on a current state of each logic reading from logic devices 104 A to 104 C .
- Method 400 allows periodic SET errors to pass through error threshold comparator 309 without affecting normal operation of system 100.
- Each of logic devices 104 A to 104 C will remain substantially functional, with minimal downtime, while fault detection processor assembly 102 maintains a desired fault tolerance level.
- system controller 110 determines whether the programmable error threshold value for error filter counter 316 has changed from a previous or default level. If the threshold value changed, a current programmable error threshold level is transferred from system controller 110 (step 407). If the programmable error threshold level did not change, or the programmable error threshold level is fixed at a predetermined level, TMR voter logic 202 receives a logic reading from each of logic devices 104 A to 104 C (step 408). Each of the three or more logic readings received is compared with at least two other logic readings at step 410. At step 412, TMR/DMR word voter 308 determines whether all of the three or more logic readings are in agreement. Determining whether all of the three or more logic readings are in agreement involves determining which of logic devices 104 A to 104 C changed state. Any of logic devices 104 A to 104 C that change state are considered a suspect device.
- error filter counter 316 When all of the three or more logic readings are in agreement, error filter counter 316 is decremented by one at step 415, and method 400 returns to step 404. When one of the three logic readings is not in agreement with the at least remaining two, a single event fault has been detected. Error filter counter 316 is incremented by one at step 414 to indicate that at least one additional single event fault has occurred. Error threshold comparator 309 indicates to system controller 110 when error filter counter 316 exceeds the threshold level (step 416). If the threshold level is not exceeded, method 400 returns to step 404.
- TMR/DMR word voter 308 compares each logic reading of the at least remaining two remaining logic devices 104 A to 104 C with each another. If TMR/DNM word voter 308 determines that the at least two remaining logic readings are in agreement with each another (step 420), the suspect device that was determined not to be in agreement with the at least two remaining of logic devices 104 A to 104 C is automatically reconfigured at step 422. Otherwise, each of logic devices 104 A to 104 C is automatically reconfigured at step 424. Reaching step 424 indicates to system 100 that a fatal or SCP error has occurred. Method 400 returns to step 404 once the suspect device is automatically reconfigured in step 422, or once each of logic devices 104 A to 104 C are automatically reconfigured at step 424.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Hardware Redundancy (AREA)
- Tests Of Electronic Circuits (AREA)
Claims (5)
- System (100) zum Tolerieren eines Einzelereignisfehlers in einer elektronischen Schaltung (102), umfassend:einen Hauptprozessor (110);einen auf den Hauptprozessor reagierenden Fehlerdetektionsprozessor (106), wobei der Fehlerdetektionsprozessor ferner eine Voter-Logikschaltung (202) umfasst;drei oder mehr am Einsatzort programmierbare Logikeinrichtungen (104A, ..., 104C), die auf den Fehlerdetektionsprozessor (106) reagieren, wobei jede Ausgabe der drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen (104A, ..., 104C) die Voter-Logikschaltung (202) durchläuft; undein programmierbares Fehlerfilter, das einen Fehlerfilterzähler (316) umfasst, wobei ein Ausgang der Voter-Logikschaltung (202) mit dem programmierbaren Fehlerfilter gekoppelt ist, wobei, wenn die drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen miteinander übereinstimmen, der Fehlerfilterzähler dekrementiert wird und wenn die drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen nicht miteinander übereinstimmen, der Fehlerfilterzähler inkrementiert wird, wobei der programmierbare Fehlerfilter bestimmt, ob ein Fehlerzählwert, der einer Anzahl von Malen entspricht, wie oft die drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen nicht miteinander übereingestimmt haben, eine programmierbare Fehlerschwelle (309) überschritten hat und wenn der Fehlerzählwert die programmierbare Fehlerschwelle (309) überschreitet, das programmierbare Fehlerfilter (316) dem Hauptprozessor (110) ein Vorbestimmtes Schwellenauftreten von sequentiellen Einzelereignis-Fehlerzuständen angibt, so dass der Fehlerdetektionsprozessor eine Umkonfiguration einer oder aller der drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen einleitet, indem er mindestens eine Menge von maschinencodierten Anweisungen von Vorgabe-Konfigurationssoftware aus dem Fehlerdetektionsprozessor zu einer oder allen der drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen transferiert.
- System (100) nach Anspruch 1, wobei der Hauptprozessor (110) ein Mikrocontroller oder eine programmierbare Logikeinrichtung ist.
- System (100) nach Anspruch 1, wobei der Fehlerdetektionsprozessor (106) eine anwendungspezifische integrierte Schaltung oder ein Mikrocontroller oder eine programmierbare Logikeinrichtung ist.
- System (100) nach Anspruch 1, wobei die drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen (104A, ..., 104C) ein am Einsatzort programmierbares Gatearray und/oder ein am Einsatzort programmierbares Objektarray umfassen.
- System (100) nach Anspruch 1, wobei der Hauptprozessor dafür ausgelegt ist, eine Neusynchronisation der drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen (104A, ..., 104C) nach der Umkonfiguration der einen oder allen der drei oder mehr am Einsatzort programmierbaren Logikeinrichtungen einzuleiten.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/379,633 US20070260939A1 (en) | 2006-04-21 | 2006-04-21 | Error filtering in fault tolerant computing systems |
PCT/US2007/001351 WO2007133300A2 (en) | 2006-04-21 | 2007-01-19 | Error filtering in fault tolerant computing systems |
Publications (2)
Publication Number | Publication Date |
---|---|
EP2013733A2 EP2013733A2 (de) | 2009-01-14 |
EP2013733B1 true EP2013733B1 (de) | 2012-02-22 |
Family
ID=38662533
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP07716774A Expired - Fee Related EP2013733B1 (de) | 2006-04-21 | 2007-01-19 | Fehlerfilterung in fehlertoleranten datenverarbeitungssystemen |
Country Status (4)
Country | Link |
---|---|
US (1) | US20070260939A1 (de) |
EP (1) | EP2013733B1 (de) |
JP (1) | JP5337022B2 (de) |
WO (1) | WO2007133300A2 (de) |
Families Citing this family (32)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080195789A1 (en) * | 2006-08-14 | 2008-08-14 | Paul Douglas Stoner | Method And Apparatus For Handling Data And Aircraft Employing Same |
US20080089087A1 (en) * | 2006-10-16 | 2008-04-17 | Paul Douglas Stoner | Apparatus and Method Pertaining to Light-Based Power Distribution in a Vehicle |
US7743285B1 (en) * | 2007-04-17 | 2010-06-22 | Hewlett-Packard Development Company, L.P. | Chip multiprocessor with configurable fault isolation |
JP2009187199A (ja) * | 2008-02-05 | 2009-08-20 | Panasonic Corp | 情報処理システム及び情報処理方法 |
US8200947B1 (en) * | 2008-03-24 | 2012-06-12 | Nvidia Corporation | Systems and methods for voting among parallel threads |
IT1391785B1 (it) * | 2008-11-21 | 2012-01-27 | St Microelectronics Srl | Sistema elettronico per il rilevamento di un guasto |
US8489919B2 (en) * | 2008-11-26 | 2013-07-16 | Arizona Board Of Regents | Circuits and methods for processors with multiple redundancy techniques for mitigating radiation errors |
JP5446229B2 (ja) * | 2008-12-04 | 2014-03-19 | 日本電気株式会社 | 電子デバイス、電子デバイスの故障検出方法および電子デバイスの故障回復方法 |
CN101562543B (zh) * | 2009-05-25 | 2013-07-31 | 阿里巴巴集团控股有限公司 | 一种缓存数据的处理方法、处理***和装置 |
US8564616B1 (en) | 2009-07-17 | 2013-10-22 | Nvidia Corporation | Cull before vertex attribute fetch and vertex lighting |
US8542247B1 (en) | 2009-07-17 | 2013-09-24 | Nvidia Corporation | Cull before vertex attribute fetch and vertex lighting |
US8976195B1 (en) | 2009-10-14 | 2015-03-10 | Nvidia Corporation | Generating clip state for a batch of vertices |
US8384736B1 (en) | 2009-10-14 | 2013-02-26 | Nvidia Corporation | Generating clip state for a batch of vertices |
JP5660798B2 (ja) * | 2010-04-01 | 2015-01-28 | 三菱電機株式会社 | 情報処理装置 |
JP5618792B2 (ja) * | 2010-11-30 | 2014-11-05 | 三菱電機株式会社 | エラー検出修復装置 |
JP5699057B2 (ja) * | 2011-08-24 | 2015-04-08 | 株式会社日立製作所 | プログラマブルデバイス、プログラマブルデバイスのリコンフィグ方法および電子デバイス |
JP5569752B2 (ja) * | 2011-12-08 | 2014-08-13 | 株式会社デンソー | 電子制御装置、および、これを用いた電動パワーステアリング装置 |
US9026864B2 (en) * | 2012-02-29 | 2015-05-05 | Red Hat, Inc. | Offloading health-checking policy |
JP2014052781A (ja) * | 2012-09-06 | 2014-03-20 | Fujitsu Telecom Networks Ltd | Fpga監視制御回路 |
US9116531B2 (en) * | 2013-02-27 | 2015-08-25 | General Electric Company | Methods and systems for current output mode configuration of universal input-output modules |
US9612900B2 (en) * | 2013-03-15 | 2017-04-04 | SEAKR Engineering, Inc. | Centralized configuration control of reconfigurable computing devices |
JP6182924B2 (ja) * | 2013-03-25 | 2017-08-23 | オムロン株式会社 | 同期シリアルインタフェース回路およびモーション制御機能モジュール |
JPWO2015068207A1 (ja) * | 2013-11-05 | 2017-03-09 | 株式会社日立製作所 | プログラマブルデバイス |
US9294263B2 (en) * | 2014-01-02 | 2016-03-22 | Advanced Micro Devices, Inc. | Methods and systems of synchronizer selection |
US8922242B1 (en) * | 2014-02-20 | 2014-12-30 | Xilinx, Inc. | Single event upset mitigation |
WO2017091399A1 (en) * | 2015-11-23 | 2017-06-01 | Armor Defense Inc. | Extracting malicious instructions on a virtual machine in a network environment |
US10255432B2 (en) | 2015-11-23 | 2019-04-09 | Armor Defense Inc. | Detecting malicious instructions on a virtual machine using profiling |
GB2555627B (en) * | 2016-11-04 | 2019-02-20 | Advanced Risc Mach Ltd | Error detection |
US10185635B2 (en) * | 2017-03-20 | 2019-01-22 | Arm Limited | Targeted recovery process |
US10423504B2 (en) * | 2017-08-04 | 2019-09-24 | The Boeing Company | Computer architecture for mitigating transistor faults due to radiation |
CN111506448B (zh) * | 2020-04-16 | 2023-03-24 | 广西师范大学 | 一种二维处理器阵列的快速重构方法 |
WO2021101643A2 (en) * | 2020-10-16 | 2021-05-27 | Futurewei Technologies, Inc. | Cpu-gpu lockstep system |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040078653A1 (en) * | 2002-10-21 | 2004-04-22 | International Business Machines Corporation | Dynamic sparing during normal computer system operation |
Family Cites Families (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4644498A (en) * | 1983-04-04 | 1987-02-17 | General Electric Company | Fault-tolerant real time clock |
JPH0619641B2 (ja) * | 1983-07-15 | 1994-03-16 | 株式会社日立製作所 | 多重系制御システムのデータ管理方式 |
CA1341310C (en) * | 1988-07-15 | 2001-10-23 | Robert Filepp | Interactive computer network and method of operation |
JPH04195639A (ja) * | 1990-11-28 | 1992-07-15 | Teijin Seiki Co Ltd | 多重プロセッサシステム及びその出力管理方法 |
JP3246751B2 (ja) * | 1991-01-25 | 2002-01-15 | 株式会社日立製作所 | 高信頼化コンピュータシステム及びその復旧方法並びにプロセッサボード及びその交換方法 |
JP2821307B2 (ja) * | 1992-03-23 | 1998-11-05 | 株式会社日立製作所 | 高信頼化コンピュータシステムの割込み制御方法 |
JPH07175765A (ja) * | 1993-10-25 | 1995-07-14 | Mitsubishi Electric Corp | 計算機の障害回復方法 |
JP3365581B2 (ja) * | 1994-07-29 | 2003-01-14 | 富士通株式会社 | 自己修復機能付き情報処理装置 |
JPH08235015A (ja) * | 1995-02-27 | 1996-09-13 | Mitsubishi Electric Corp | プロセッサ装置並びにプロセッサ故障診断方法 |
JP3438490B2 (ja) * | 1996-10-29 | 2003-08-18 | 株式会社日立製作所 | 冗長システム |
US6178522B1 (en) * | 1998-06-02 | 2001-01-23 | Alliedsignal Inc. | Method and apparatus for managing redundant computer-based systems for fault tolerant computing |
US6104211A (en) * | 1998-09-11 | 2000-08-15 | Xilinx, Inc. | System for preventing radiation failures in programmable logic devices |
US6856600B1 (en) * | 2000-01-04 | 2005-02-15 | Cisco Technology, Inc. | Method and apparatus for isolating faults in a switching matrix |
US6715116B2 (en) * | 2000-01-26 | 2004-03-30 | Hewlett-Packard Company, L.P. | Memory data verify operation |
US6910173B2 (en) * | 2000-08-08 | 2005-06-21 | The Board Of Trustees Of The Leland Stanford Junior University | Word voter for redundant systems |
EP1246033A1 (de) * | 2001-08-23 | 2002-10-02 | Siemens Aktiengesellschaft | Verfahren zur Überwachung konsistenter Speicherinhalte in redundanten Systemen |
US20040078508A1 (en) * | 2002-10-02 | 2004-04-22 | Rivard William G. | System and method for high performance data storage and retrieval |
JP2004133496A (ja) * | 2002-10-08 | 2004-04-30 | Hitachi Ltd | コンピュータシステム |
US20060020852A1 (en) * | 2004-03-30 | 2006-01-26 | Bernick David L | Method and system of servicing asynchronous interrupts in multiple processors executing a user program |
US20050268061A1 (en) * | 2004-05-31 | 2005-12-01 | Vogt Pete D | Memory channel with frame misalignment |
US7392426B2 (en) * | 2004-06-15 | 2008-06-24 | Honeywell International Inc. | Redundant processing architecture for single fault tolerance |
US7320064B2 (en) * | 2004-07-23 | 2008-01-15 | Honeywell International Inc. | Reconfigurable computing architecture for space applications |
-
2006
- 2006-04-21 US US11/379,633 patent/US20070260939A1/en not_active Abandoned
-
2007
- 2007-01-19 JP JP2009506481A patent/JP5337022B2/ja not_active Expired - Fee Related
- 2007-01-19 EP EP07716774A patent/EP2013733B1/de not_active Expired - Fee Related
- 2007-01-19 WO PCT/US2007/001351 patent/WO2007133300A2/en active Application Filing
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040078653A1 (en) * | 2002-10-21 | 2004-04-22 | International Business Machines Corporation | Dynamic sparing during normal computer system operation |
Also Published As
Publication number | Publication date |
---|---|
JP2009534738A (ja) | 2009-09-24 |
JP5337022B2 (ja) | 2013-11-06 |
WO2007133300A3 (en) | 2008-03-13 |
US20070260939A1 (en) | 2007-11-08 |
WO2007133300A2 (en) | 2007-11-22 |
EP2013733A2 (de) | 2009-01-14 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP2013733B1 (de) | Fehlerfilterung in fehlertoleranten datenverarbeitungssystemen | |
US20070220367A1 (en) | Fault tolerant computing system | |
US7290169B2 (en) | Core-level processor lockstepping | |
US7793147B2 (en) | Methods and systems for providing reconfigurable and recoverable computing resources | |
KR100566338B1 (ko) | 폴트 톨러런트 컴퓨터 시스템, 그의 재동기화 방법 및 재동기화 프로그램이 기록된 컴퓨터 판독가능 기억매체 | |
JP6484330B2 (ja) | 2路アーキテクチャ | |
JP2020030815A (ja) | 飛行制御システム | |
US7296181B2 (en) | Lockstep error signaling | |
US10042812B2 (en) | Method and system of synchronizing processors to the same computational point | |
US5020024A (en) | Method and apparatus for detecting selected absence of digital logic synchronism | |
US5572620A (en) | Fault-tolerant voter system for output data from a plurality of non-synchronized redundant processors | |
US9367375B2 (en) | Direct connect algorithm | |
US20070186126A1 (en) | Fault tolerance in a distributed processing network | |
US10599534B1 (en) | Three lane bit-for-bit remote electronic unit | |
US5905875A (en) | Multiprocessor system connected by a duplicated system bus having a bus status notification line | |
CN113806290B (zh) | 一种用于综合模块化航空电子***的高完整性片上*** | |
US9665447B2 (en) | Fault-tolerant failsafe computer system using COTS components | |
US10621024B2 (en) | Signal pairing for module expansion of a failsafe computing system | |
JP3063334B2 (ja) | 高信頼度化情報処理装置 | |
US9311212B2 (en) | Task based voting for fault-tolerant fail safe computer systems | |
JPH1011309A (ja) | プロセッサ出力比較方法およびコンピュータシステム | |
Rennels et al. | Recovery in fault-tolerant distributed microcontrollers | |
US10621031B2 (en) | Daisy-chain of safety systems | |
Wirthumer et al. | Fault Tolerance for Railway Signalling Votrics in Practice | |
JP2645880B2 (ja) | システムクロック二重化方式 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20081015 |
|
AK | Designated contracting states |
Kind code of ref document: A2 Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR |
|
AX | Request for extension of the european patent |
Extension state: AL BA HR MK RS |
|
17Q | First examination report despatched |
Effective date: 20090202 |
|
DAX | Request for extension of the european patent (deleted) | ||
RBV | Designated contracting states (corrected) |
Designated state(s): DE FR GB IT |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: G06F 11/18 20060101AFI20111004BHEP Ipc: G06F 11/07 20060101ALI20111004BHEP |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): DE FR GB IT |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602007020843 Country of ref document: DE Effective date: 20120419 |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
26N | No opposition filed |
Effective date: 20121123 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R097 Ref document number: 602007020843 Country of ref document: DE Effective date: 20121123 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20141230 Year of fee payment: 9 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: FR Payment date: 20141226 Year of fee payment: 9 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: IT Payment date: 20150122 Year of fee payment: 9 Ref country code: DE Payment date: 20150126 Year of fee payment: 9 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R119 Ref document number: 602007020843 Country of ref document: DE |
|
GBPC | Gb: european patent ceased through non-payment of renewal fee |
Effective date: 20160119 |
|
REG | Reference to a national code |
Ref country code: FR Ref legal event code: ST Effective date: 20160930 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: DE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20160802 Ref country code: GB Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20160119 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: FR Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20160201 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IT Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20160119 |
|
P01 | Opt-out of the competence of the unified patent court (upc) registered |
Effective date: 20230525 |